From efdf153f0a64d249e5c488f716a779e309beb7cf Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Sat, 3 Oct 2026 09:42:13 +0800
Subject: [PATCH] fix(shoukei): stop latched nscd failures on resolvconf
 restarts

---
 hosts/12kingdoms-shoukei/default.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/hosts/12kingdoms-shoukei/default.nix b/hosts/12kingdoms-shoukei/default.nix
index 5501e1bf..ddab8790 100644
--- a/hosts/12kingdoms-shoukei/default.nix
+++ b/hosts/12kingdoms-shoukei/default.nix
@@ -24,6 +24,21 @@ in
   # Laptop joins untrusted networks and is no longer scraped; don't expose :9100.
   services.prometheus.exporters.node.enable = lib.mkForce false;
 
+  # resolvconf restarts nscd on every /etc/resolv.conf rewrite (see
+  # /etc/resolvconf.conf). Boot network churn exceeds the default start limit
+  # (5/10s) and latches nscd into `failed`, which also fails nss-lookup.target /
+  # nss-user-lookup.target; `try-restart` cannot revive it. nscd cannot be
+  # disabled (NixOS loads NSS modules through it, see nsswitch.nix), so don't
+  # rate-limit these external restarts and back off on the crash path instead.
+  systemd.services.nscd = {
+    startLimitIntervalSec = 0;
+    serviceConfig = {
+      RestartSec = "1s";
+      RestartSteps = 5;
+      RestartMaxDelaySec = "60s";
+    };
+  };
+
   networking = {
     inherit hostName;
     inherit (myvars.networking) nameservers;